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ARCHITECTURE FOR VIRTUAL PRIVATE NETWORKS 
BACKGROUND OF THE INVENTION 

1. Related Information 

The present invention is related to the one described in copending U.S. Patent 
5 Application entitled "An Apparatus for Implementing Virtual Private Networks " 
Serial No. 08/874,091 [Attorney Docket No. 20155-702], assigned to the assignee of 
the present application and filed concurrently herewith. 

2. Field of the Invention 

The present invention relates to the field of data communications. More 
1 0 particularly, the present invention relates to techniques for implementing secure 
virtual private networks over public or otherwise insecure data communications 
infrastructures. 

3. Background 

In recent years organizations have come to rely heavily on the ability to 
1 5 transmit electronic data between members of the organization. Such data typically 
includes electronic mail and file sharing or file transfer. In a centralized, single site 
organization, these transfers of electronic data are most commonly facilitated by a 
local area network (LAN) installed and operated by the particular enterprise. 

Preventing unauthorized access to data traversing an enterprise's LAN is 
20 relatively straightforward. This applies to both unauthorized accesses by members of 
the enterprise and, more importantly, to third parties on the outside. As long as 
intelligent network management is maintained, unauthorized accesses to data 
traversing an enterprise's internal LAN are relatively easily avoided. It is when the 
enterprise spans muhiple sites that security threats from the outside become a major 
25 concern. 

For distributed enterprises that desire the conveniences of the above-described 
electronic data transfers, there are several options that exist today, but each with 
associated disadvantages. The first option is to interconnect the offices or various 
sites v^th dedicated, or private commimications connections often referred to as 
30 leased lines. This is the traditional method organizations use to implement a wide 
area network (WAN). The disadvantages of implementing an enterprise owned and 
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controlled WAN are obvious: they are expensive, cumbersome and frequently 
underutilized if they are established to handle the peak capacity requirements of the 
enterprise. The obvious advantage to this approach is that the lines are dedicated for 
use by the enterprise and are therefore secure, or reasonably secxire, from 
5 eavesdropping or tampering by intermediate third parties. 

An alternative to the use of dedicated communications lines in a w^ide area 
network is for an enterprise to handle intersite data distributions over the emerging 
public network space. Over recent years, the Internet has transitioned from being 
primarily a tool for scientists and academics to a mechanism for global 

10 communications with broad ranging business implications. The Internet provides 
electronic communications paths between millions of computers by interconnecting 
the various networks upon which those computers reside. It has become 
commonplace, even routine, for enterprises, even those in nontechnical fields, to 
provide Internet access to at least some portion of the computers within the enterprise. 

15 For many businesses this facilitates communications with customers, potential 
business partners as well as the distributed members of the organization. 

Distributed enterprises have found that the Internet is a convenient tool to 
provide electronic communications between members of the enterprise. For example, 
two remote sites within the enterprise may each connect to the Internet through a local 

20 Internet Service Provider (ISP). This enables the various members of the enterprise to 
communicate with other sites on the Internet including those within their own 
organization. The limiting disadvantage of using the Internet for intra-enterprise 
communications is that the Internet is a public network space. The route by which 
data communication travel from point to point can vary on a per packet basis, and is 

25 essentially indeterminate. Further, the data protocols for transmitting information 
over the various networks of the Internet are widely known, and leave electronic 
communications susceptible to interception and eavesdropping wdth packets being 
replicated at most intermediate hops. An even greater concern arises when it is 
realized that communications can be modified in transit or even initiated by 

30 impostors. With these disconcerting risks, most enterprises are unwilling to subject 
their proprietary and confidential internal conununications to the exposure of the 
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public network space. For many organizations it is common today to not only have 
Internet access provided at each site, but also to maintain the existing dedicated 
commimications paths for internal enterprise communications, with all of the 
attendant disadvantages described above. 
5 While various encryption and other protection mechanisms have been 

developed for data communications, none completely and adequately addresses the 
concems raised for allowing an enterprise to truly rely on the public network space for 
secure intra-enterprise data communications. It would be desirable, and is therefore 
an object of the present invention to provide such mechanisms which would allow the 

1 0 distributed enterprise to rely solely on the public network space for intra-enterprise 
communications without concern for security risks that presently exist. 

SUMMARY OF THE INVENTION 
From the foregoing it can be seen that it would be desirable and advantageous 
to develop protocols and architecture to allow a single organization or enterprise to 

1 5 rely on the public network space for secure intraorganizational electronic data 
communications. The present invention is thus directed toward the protocols and 
architecture for implementing secure virtual private networks over the Internet or 
other public network systems. The architecture of the present invention introduces a 
site protector or virtual private network (VPN) unit which moderates data 

20 communications between members of a defined VPN group. In accordance with one 
embodiment of the present invention, the site protector resides on the WAN side of 
the site's router or routing apparatus which is used to connect the enterprise site to the 
Internet. In alternative embodiments, the site protector will reside on the LAN side of 
the router. The essential point for all embodiments is that the site protector be in the 

25 path of all relevant data traffic. 

To ensure secure data communications between members of the same VPN 
group, the site protector or VPN unit implements a combination of techniques for data 
packet handling when packets are to be sent between members of the group. The 
packet handling processes include various combinations of compression, encryption 

30 and authentication, the rules for each of which may vary for members of different 
groups. For each group defined as a virtual private network, the various parameters 
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defining the compression, encryption and authentication are maintained in lookup 
tables in the associated VPN units. The lookup tables maintain information not only 
for fixed address members of the group but support is also provided for remote 
clients. This ability allows remote users to dial into a local Internet Service Provider 
5 and still maintain membership in a virtual private network group for secure 

communications over the Internet with other members of the group. In the case of a 
remote client, the site protector may, in one embodiment, be simulated by software 
running on the remote client. 

In other aspects of the present invention, the VPN units or site protectors may 

1 0 be dynamically configured to add or subtract members from the virtual private 

network group or recognize their movement, or change other parameters affecting the 
group. Various other packet handling aspects of the invention include addressing the 
problem of some data packets growing too large by the inclusion of encryption and 
authentication information. Another packet handling aspect provides a mechanism for 

1 5 Internet communications which hides information identifying the source and 

destination of the data packet. In this aspect of the present invention, the VPN units 
are treated as the source and destination for the Internet communication data packets 
with the VPN units encapsulating the source and destination addresses of the 
endstations. 

20 BRIEF DESCRIPTION OF THE DRAWINGS 

The objects, features and advantages of the present invention will be apparent 
from the following detailed description, in which: 

Figure 1 illustrates a prior art configuration for an exemplary enterprise's 
intraenterprise communication architecture. 
25 Figure 2 illustrates an enterprise communication scenario in accordance Avith 

the present invention utilizing the Internet or other public network space as the vehicle 
for conveying messages between members of a virtual private network. 

Figure 3 illustrates a flow diagram for the handling of a packet being 
transmitted from one member of a virtual private network group to another member 
30 over the Internet. 
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Figure 4 illustrates the handling of a data packet received over the Internet by 
one nntember of a virtual private network group from another member. 

Figure 5 illustrates graphically the life cycle of a data packet being sent from 
one member of a virtual private network group to another over the Internet. 
5 Figure 6 illustrates an alternate life cycle of a data packet being sent from one 

member of a virtual private network group to another over the Internet where the 
source and destination addresses of the group members are also concealed. 

DETAILED DESCRIPTION OF THE INVENTION 
Protocols and an architecture are disclosed for implementing secure virtual 

10 private networks for enterprise communications over the Internet or other public 

network space. Although the present invention is described predominantly in terms of 
utili2dng the Internet as a communications medium, the concepts and methods are 
broad enough to accomplish the implementation of secure virtual private networks 
over other public or insecure communications media. Throughout this detailed 

15 description, numerous specific details are set forth such as particular encryption or key 
management protocols, in order to provide a thorough understanding of the present 
invention. To one skilled in the art, however, it will be understood that the present 
invention may be practiced without such specific details. In other instances, well- 
known control structures and system components have not been shown in detail in 

20 order not to obscure the present invention. 

In many instances, components implemented by the present invention are 
described at an architectural, functional level. Many of the elements may be 
configured using well-known structures, particularly those designated as relating to 
various compression or encryption techniques. Additionally, for logic to be included 

25 within the system of the present invention, functionality and flow diagrams are 
described in such a maimer that those of ordinary skill in the art will be able to 
implement the particular methods without undue experimentation. It should also be 
understood that the techniques of the present invention may be implemented using a 
variety of technologies. For example, the virtual private network unit or site protector 

30 to be described further herein may be implemented in software nmning on a computer 
system, or implemented in hardware utilizing either a combination of microprocessors 
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or other specially designed application specific integrated circuits, programmable 
logic devices, or various combinations thereof. It will be understood by those skilled 
in the art that the present invention is not limited to any one particular implementation 
technique and those of ordinary skill in the art, once the functionality to be carried out 
5 by such components is described, will be able to implement the invention with various 
technologies without undue experimentation. 

Referring now to Figure 1 there is shown a traditional scenario for intra- 
enterprise data communications for a distributed organization. In this illustration of 
an exemplary organization configuration, the enterprise consists of a headquarters 

10 location 105 with additional sites or branches 110 and 1 12, respectively. In modem 
organizations, such as the exemplary one of Figure 1, the headquarters' site 105 as 
well as the branch sites 110 and 1 12 may each comprise numerous personnel, many of 
whom are provided with computers or work stations with network access. The 
internal network configurations at the headquarters for branches may take many forms 

1 5 including one or several local area networks (LANs). For intersite communications 
between headquarters and the branches, dedicated or leased communications lines 1 1 5 
and 120 may be provided. In addition, an optional dedicated communications path 
125 may be provided between the branches 110 and 112. As an alternative to the 
optional dedicated communications line 125 between the branches, data packets 

20 between branch 1 10 and branch 1 12 may be routed through the headquarters' network 
equipment. 

In addition to the dedicated communications lines between the headquarters 
and the various branches, it is conunon today to provide computer users within an 
organization access to the Internet for electronic mail to external parties as well as for 

25 doing various types of research over the Internet using such tools as the World Wide 
Web, etc. As shown in Figure 1, the usual scenario where the headquarters' site 105 
and the branches 1 10 and 1 12 are each separately provided with direct access to 
Internet Service Providers 130, 133 and 136, respectively. This facilities the users at 
the various sites with their access to the Intemet for the above purposes. In an 

30 alternate configuration, it may be that only the headquarters site 105 is provided with 
access to an Intemet service provider 1 30 and that users of the computers of the 
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branch sites 110 and 1 12 will connect to the Internet through headquarters via their 
dedicated communications paths 115 and 120. The downside to this alternate 
configuration is that it greatly increases the bandwidth utilization on the dedicated 
lines, perhaps to the point of saturation. An advantage is that only one gateway to the 
5 Internet need be provided for the organization which simplifies enforcing security 
constraints on connections to the outside world. 

In the exemplary organization 100, it is also shown that in some circumstances 
it may be desirable to allow customers or other business partners to dial in directly to 
the computer network of the organization. In Figure 1 it is illustrated that the 

1 0 customer 1 40 may in fact carry out such communications over a communications path 
145 which may be a dedicated line provided between the customer and the 
organization for the customer's convenience. The path 145 may also be a dial-up line 
which the customer might use only sporadically. Consistent with the emerging use of 
the Internet and its popularity, the customer 140 is shown having its own Internet 

1 5 connection through ISP 1 48. 

Finally, there is shown in Figure 1 that it is frequently desirable for other 
members of the enterprise who may be on the road or working from home or otlier 
remote locations to exchange data with other members of the enterprise. There is thus 
shown remote clients 1 50 and 1 55 communicating with the headquarters over long 

20 distance telephone lines 1 57 and 158, This example assumes that the remote clients 
are in a truly remote location from the headquarters. The remote clients 150 and 155 
are also respectively shown having local access to the Internet through local ISPs 160 
and 165. 

The above description of an enterprises data communications configuration 
25 according to Figure 1 illustrates the disadvantages described in the previous section. 
These disadvantages are eliminated by implementation of the present invention as 
illustrated generally v^th reference to Figure 2. In the enterprise network 
communication configuration 200 illustrated in Figure 2, the headquarters 105, first 
branch 110 and second branch 1 12 of the organization are illustrated in a more 
30 detailed logical way then presented in Figure 1 . Thus, the headquarters 105 is 
illustrated with three endstations 201, 202 and 203, respectively coupled to 
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communicate data packets over local area network (LAN) 205. Likewise, the branch 
site 11 0 is shown having a plurality of endstations 21 1 , 21 2 and 21 3 respectively 
coupled to commxmicate data locally over LAN 215. Finally, the second branch site 
1 12 is shovm with an illustrative set of computer stations 221, 222 and 223 connected 
5 to communicate over LAN 225. The customer site 140 is also illustrated in Figure 2 
as comprising of plurality of computers illustrated by 331 and 332 coupled to 
communicate over the customer's LAN 235. The local area networks utilized for data 
communications within the headquarters, customer and branch sites may adhere to a 
wide variety of network protocols, the most common of which are Ethernet and Token 
10 Ring. 

As can be seen in Figure 2, the dedicated communications lines between the 
headquarters site 105 and the branch sites 110 and 1 12 as well as between the 
headquarters site 105 and the customers site 140 have been eliminated. Instead, in 
accordance with the present invention data communications between members of the 

1 5 organization are intended to be carried out over the Internet or other public network 
space. For purposes of the present invention, it will be assumed that it is the widely 
emerging Internet that will be the medium for data packet transfers between members 
of the organization. 

Each of the LANs for the particular sites illustrated in Figure 2 ultimately 

20 interconnect to the Internet 250 through an associated routing or gateway device 
which are identified as routers 240, 242, 244 and 246, respectively. It is to be 
xmderstood that data packets conveyed between a various sites illustrated in 200 
would traverse, in many cases, a plurality of additional routing devices on their way 
between the source and destination sites for the packets. The mechanisms for data 

25 packet transfers over the Internet are well known and are not described in great detail 
herein. It is understood that data packets are assembled in accordance with the 
Internet Protocol (IP) and are refened to herein as IP packets regardless of the version 
of the Internet protocol presently in effect. In the case of the remote clients 1 50 and 
155 illustrated in Figure 2 it is understood that they utilize communication software to 

30 dial up a local Internet service provider which itself provides the gateways necessary 
for communications over the Internet 250. 



wo 98/57465 



9 



PCT/US98/12229 



As has been described above, prior efforts to utilize the Internet for secure data 
conmiunications have required an av^areness or implementation of security 
considerations at the endstations. This is disadvantageous when transparency to an 
end user is desirable. The present invention, on the other hand is transparent to end 
5 users with data communications over the Internet occurring exactly as they appear to 
have before. However, for users identified as members of the same virtual private 
network, data communications are handled in a manner that assures the security and 
integrity of the data packets. Illustrated in Figure 2, between the Internet 250 and 
each of the respective routers 240, 242, 244 and 246, are Virtual Private Network 

1 0 Units (VPNUs) 250, 252, 254 and 256. In accordance with the particular illustrated 
embodiment of the present invention, the VPNUs reside between a site's router and 
the path to the Internet. It should be understood that this placement of VPN units in 
the overall system architecture represents only one placement choice. It will be clear 
from the materials that follow that the key point with respect to VPNU placement is 

1 5 that they reside in the path of data traffic. In many embodiments, it may in fact prove 
desirable to situate the VPNU on the LAN side of a site's router. As will be described 
in more detail below, the VPN units maintain lookup tables for identifying members 
of specific virtual private network groups. 

When a data packet is sent between source and destination addresses that are 

20 both members of the same VPN group, the VPNU will process the data packet from 
the sending side in such a way as to ensure that it encrypted, authenticated and 
optionally compressed. Likewise, the VPNU servicing the site where the destination 
address is located will detect that a packet is being propagated between members of 
the same VPN group. The receiving VPNU will handle the process of decrypting and 

25 authenticating the packet before forwarding it toward the destination endstation. In 
this way, secure data communications between end users is effected in a manner that 
is transparent to the end users. In the case of remote chents 150 and 155, the VPNU 
may be simulated in software which operates in conjunction with the communication 
software for connecting the remote client to the associated local Internet service 

30 provider. 
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The functionality of the VPN units will be described with reference to the 
following figures beginning with the flowchart of Figure 3. When a data packet 
originates from an endstation, such as endstation 202 of LAN 205 at site 105, and its 
destination is to a remote site, other than the headquarters site 105, it will initially be 
5 treated as an ordinary Internet data packet transfer. The packet will proceed from the 
endstation 202 over the LAN 205 to the routing device 240 which will encapsulate the 
data packet in accordance with the Internet Protocol, forming an outboimd IP packet. 
On its way out of the site, the IP packet v^U pass through the associated VPN unit for 
the site. The flowchart illustrated at Figure 3 shows the functional operation of a VPN 

10 unit for an outbound packet that is received thereby. The Transmit Packet procedure 
300 begins when the outbound data packet is received at the VPNU at step 310. At 
decision box 320, it is determined whether or not the source and destination addresses 
for the data packet are both members of the same VPN group. This determination 
may be made with reference to lookup tables that are maintained by the VPN units or 

1 5 reference to other memory mechanisms. This step may be thought of as member 
filtering for data packets being transmitted between the particular site and the VPN 
unit which services it. If the source and destination address for the data packet are not 
both members of the same VPN group, then at step 330 the packet is forwarded to the 
Internet as ordinary Internet traffic from the site as though the VPNU were not 

20 involved. In which case, the procedure ends at step 335. In one alternative 

embodiment, it may be desirable to discard data traffic that is not destined between 
members of a VPN group rather than forwarding it as unsecure traffic. In another 
alternative embodiment, it may be desirable to provide the option to either pass or 
discard non- VPN-group data traffic. 

25 If, at decision box 320, the member filter, it is determined that both the source 

and destination addresses for the data packet are members of the same VPN group, 
then the data packet is processed at step 340 undergoing various combinations of 
compression, encryption and authentication. The lookup tables maintained by the 
VPN unit 250 and all of the VPN units, in addition to identifying members of 

30 particular VPN groups, also identify whether or not data packets transferred between 
members of the particular VPN group are to be compressed and if so, what algorithm 
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is to be used for compression. Many possible compression algorithms are well- 
known, but in one embodiment of the invention, LZW compression is implemented. 
The lookup table for the VPN group of which the source and destination addresses are 
members also identifies the particular encryption algorithm to be used for data packets 
5 traversing the Internet for that VPN group as well as the authentication and key 
management protocol information to be used thereby. As an altemative to lookup 
tables, the VPNU may be programmed to always use the same algorithms for all VPN 
groups. 

The particular packet processing algorithms to be used for VPN traffic may 

10 vary, so long as the lookup tables in both the sending and receiving VPN units 

identify the same compression, encryption and authentication rules and are capable of 
implementing and deimplementing them for members of the same group. It is to be 
understood that a single VPNU may serve multiple VPN groups and that particular 
addresses may be members of multiple groups. Thus, at step 340, when a packet is 

1 5 destined from one member of the VPN group to another, the packet is processed 
according to the compression, encryption and authentication rules identified in the 
VPNU tables for that particular VPN group. Then, at step 350, the processed packet 
is forwarded toward the destination address over the Internet, The procedure of the 
sending VPN unit then ends at step 355. 

20 The receiving VPNU reverses the above processes for VPN traffic as 

illustrated by the flowchart of Figure 4. The Receive Packet procedure 400 begins at 
step 410 when an inboimd data packet is received from the Internet at the receiving 
VPN unit. At decision box 420, the inbound data packet is examined to determine if 
the source and destination addresses of the data packet are both members of the same 

25 VPN group. It is assumed that the lookup tables maintained by all of the VPN units 
are both consistent and coherent. If the inbound data packet is determined not to be 
VPN traffic, then the packet is passed through and forwarded to the receiving site as 
though it were normal Internet data traffic at step 430. In which case the process ends 
at step 435. In one altemative embodiment, it may be desirable to discard incoming 

30 data traffic that is not from an identified member of a VPN group supported by the 
VPNU. 
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For data packets that are determined to be VPN traffic at decision box 420, the 
VPN unit will process the inbound packet to recover the original data packet as it was 
provided from the source endstation. The lookup table maintained by the receiving 
VPN unit will identify the compression, encryption and authentication rules used for 
5 the VPN group and reconstruct the original IP packet in accordance with those rules at 
step 440. Then, the reconstructed packet v^ll be delivered to the site of the 
destination address at 450 with the procedure ending at step 455. 

Figure 5 illustrates graphically the life cycle of the data packet sent between 
two members of the same VPN group. The data packet originates from a source 500 
and propagates from the sources site through its associated router to generate IP data 
packet 510. The data packet 510 is not intended to illustrate all the fields associated 
with a complete IP data packet, but shows the relevant portions for this discussion 
which include the destination address, source address and the payload information of 
the packet. The data packet 5 1 0 is then examined by the VPN unit which determines 
whether the data packet is traffic between members of an identified VPN group. The 
VPN unit 520 processes the packet in accordance with the packet processing 
procedures described above with respect to Figure 3 with the resulting packet being 
illustrated as packet 530. Packet 530 still identifies the destination and source 
addresses of the data packet, but the remainder of the packet is encrypted, and 
optionally compressed. 

Following processing by the outbound VPNU, the data packet is propagated 
through the Internet to 550 with the destination and source information identifying to 
the associated routers of the Internet the path by which the packet should ultimately 
take to reach its destination. The packet emerges from the Internet at the edge of the 
destination site as data packet 540 which is essentially identical to the data packet 
530. The packet is "deprocessed" by the receiving VPN unit 550 which restores the 
original packet into its form 560 for delivery to the ultimate destination through the 
receiving site's associated router at destination 570. 

As was described above, the present invention approach to virtual private 
networks supports not only optional compression of data packets, but encryption and 
authentication techniques as well. One emerging standard for key management in 
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connection with Internet Protocol data transfers with authentication is referred to as 
simple key management for Internet Protocol (SKIP) which is described by US Patent 
5,588,060 assigned to Sun Microsystems, Inc. of Mountain View, CA. Authenticated 
data transfers using SKIP support a mode of data transfer referred to as tunnel mode. 
5 The above described data transfer with respect to Figure 5 illustrates a transport mode 
of operation in which the data and source addresses are exposed as the data packet 
traverses the Internet, In tunnel mode, an added measure of security may be provided 
by encapsulating the entire data packet in another packet which identifies the source 
and destination addresses only for the VPN units. This conceals the ultimate source 

10 and destination addresses in transit. 

Figure 6 illustrates the life cycle of a data packet being propagated from a 
source 600 to a destination 670 utilizing tunnel mode. In this mode of operation, the 
data packet 610 is processed by outbound VPNU 620 which generates a resulting 
packet 630. The resulting packet 630 encrypts and compresses (optionally) not only 

1 5 the data pay load of the packet, but the destination and source addresses of the 
endstations as well. The encapsulated packet is then provided with an additional 
header that identifies that the source of the packet is the outbound VPNU 620 and that 
the destination is the inbound VPNU 650. Thus, the packet 640 which emerges from 
the Internet is identical to the packet 630 with respect to its source and address 

20 information and encapsulated payload. The packet is decomposed by the inbound 

VPNU 650 to reconstruct the original data packet at 660 for delivery to the destination 
670. 

The overall architecture of the present invention is robust. It allows end users 
the convenience of proprietary data communications to take place over a public 

25 network space such as the Internet. The architecture of the present invention also 
allows a wide variety of compression, encryption and authentication technologies to 
be implemented, so long as the VPN units at each end of the transaction support the 
associated protocols. The present invention is also capable of working in concert with 
traditional Internet security mechanisms such as corporate firewalls. A firewall might 

30 operate in series with the VPN unit at a given site, or, intelligently be configured in a 
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single box with the VPN unit to provide parallel firewall and VPN unit security 
functions. 

There has thus been described a protocol and architecture for implementing 
virtual private networks for using a public network space for secure private network 
5 data communications. Although the present invention has been described with respect 
to certain exemplary and implemented embodiments, it should be understood that 
those of ordinary skill in the art will readily appreciate various alternatives to the 
present invention. Accordingly, the spirit and scope of the present invention should 
be measured by the terms of the claims which follow. 
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CLAIMS 

What is claimed is: 

1 1 . A method for sending a data packet from a first member of a virtual 

2 private network to a second member of said virtual private network comprising the 

3 steps of: 

4 receiving said data packet enroute to said second member; 

5 determining that said data packet is being sent between members of 

6 said virtual private network; 

7 determining the packet manipulation rules for packets sent between 

8 members of said virtual private network; 

9 forming a secure data packet by executing said packet manipulation 

1 0 rules on said data packet; and 

1 1 forwarding said secure data packet to said second member of said 

12 virtual private network. 

1 2. The method according to claim 1 wherein said step of determining that 

2 said data packet is being sent between members of said virtual private network 

3 comprises the step of comparing the source and destination addresses of the data 

4 packet to addresses stored in a virtual private network address table. 

1 3. The method according to claim 1 wherein said step of determining the 

2 packet manipulation rules comprises the step of accessing a lookup table that 

3 maintains information identifying compression, encryption and authentication 

4 algorithms to be utilized for data packets sent between members of the virtual private 

5 network. 

1 4. The method according to claim 3 wherein said step of forming a secure 

2 data packet comprises the steps of: 

3 encrypting at least a payload portion of the data packet according to the 

4 identified encryption algorithm; and 

5 providing authentication information for the data packet according to 

6 the identified authentication algorithm. 
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1 5. The method according to claim 4 wherein said step offonning a secure 

2 data packet further comprises the step of compressing said payload portion of the data 

3 packet according to the compression algorithm identified. 

1 6. The method according to claim 5 wherein said compressing step occurs 

2 prior to said encrypting step. 

1 7. The method according to claim 3 wherein said forming a secure data 

2 packet includes the step of concealing the source and destination addresses of the data 

3 packet according to the identified packet manipulation rules. 

1 8. A method for recovering an original data packet from a secure data 
packet sent between members of a virtual private network comprising the steps of: 

3 receiving said secure data packet; 

4 determining the packet manipulation rules for packets sent between 

5 members of said virtual private network; 

6 recovering the original data packet by manipulating the secure data 
packet by reversing the identified packet manipulation rules; and 

8 forwarding the recovered data packet to its destination. 

1 9. The method according to claim 8 wherein said step of determining the 

2 packet manipulation rules comprises the step of accessing a lookup table that 

3 maintains information identifying compression, encryption and authentication 

4 algorithms to be utilized for data packets sent between members of the virtual private 

5 network. 

1 1 0. The method according to claim 9 wherein said recovering step includes 

2 the step of recovering the source and destination addresses of the original data packet 

3 when they have been concealed. 

1 11 . A method for securely exchanging data packets by members of a 

2 virtual private network comprising the steps of: 

3 generating a first data packet which includes a source address, a 

4 destination address and a data payload portion; 

5 transmitting said first data packet toward the destination address; 

6 intercepting said first data packet enroute to said destination address- 
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7 verifying that said first data packet is being sent between members of a 

8 virtual private network group; 

9 determining the packet manipulation rules for packets sent between 

1 0 members of said virtual private network group; 

1 1 generating a second data packet by performing said packet 

12 manipulation rules on said first data packet; 

13 forwarding said second data packet toward said destination address; 

14 receiving said second data packet; 

1 5 verifying that said second data packet is being sent between members 

16 of said virtual private network group; 

17 determining the packet manipulation rules for packets sent between 

18 members of said virtual private network group; 

19 generating a third packet by reversing the identified packet 

20 manipulation rules, said third packet including said data payload portion; and 

21 delivering said third data packet to said destination address. 

1 12. The method according to claim 1 1 wherein said second packet conceals 

2 said source and destination addresses. 

1 13. The method according to claim 1 1 wherein said step of generating a 

2 third packet includes the step of recovering said source and destination addresses for 

3 inclusion in said third packet. 

1 14. A system for securely exchanging data packets between members of a 

2 virtual private network group comprising: 

3 a first computer at a first site, said first computer having a first network 

4 address; 

5 a first router associated with said first site for routing data packets 

6 originating from said first computer over a public network; 

7 a first virtual private network unit disposed between said router and 

8 said public network, said first virtual public network unit for identifying virtual 

9 private network group data traffic and for securing said data traffic by manipulating 

10 said data traffic according to packet manipulation rules maintained by said virtual 

1 1 private network unit; 



wo 98/57465 



18 



PCT/US98/12229 



12 a second router associated with a second site for coupling said second 

1 3 site to the public network; 

1 4 a second virtual private network unit disposed between said second 

1 5 router and the public network for intercepting network traffic destined for said second 

1 6 site, said second virtual public network unit for detecting virtual private network 

1 7 group traffic and for recovering original packet data; and 

1 8 a second computer at said second site, said second computer having a 

1 9 second network address for receiving said packet data. 

1 15. The system, of claim 14 wherein said first and second virtual private 

2 network units include means for verifying that said first and second network addresses 

3 are both members of said virtual private network group. 

1 1 6. The system of claim 1 5 wherein said first and second virtual private 

2 network units each have an associated network addresses, said network traffic 

3 utilizing the virtual private network addresses to conceal the identity of the first and 

4 second network addresses. 
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FIG. 5 



FIG. 6 



From Source 500 
(Through Router) 




D 


S 


mm 








r 






VPNU 
(Receive) 










r 




D 


S 


Data \ 



550 



From Source 600 
(Through Router) 



1 1 


r 


D 


S 


Data 1 — 510 


D 


S 


Data 1 — 610 



VPNU^ 
(Send) 



V2|ViPMPata^ 630 




V2IV1 tP^sagPata%t -640 



VPNU2 
(Receive) 



D 



^650 



Data \^ 



660 



To Destination 
(through Router) 
570 



To Destination 
(through Router) 
670 



5/5 



SUBSTITUTE SHEET ( rule 26 ) 



INTERNATIONAL SEARCH REPORT 



In tlonat Application No 

PCT/US 98/12229 



A. CLASSIFICATION OF SUBJECT MATTER 

IPC 6 H04L12/46 H04L29/06 



According to International Patent Clasatflcatron(IPC) or to both national classification and IPC 



B. FIELDS SEARCHED 



Minimum documentation searched (dasstl feat Ion system lollowed by classification symbols) 

IPC 6 H04L 



Documentation searctied other than minimum documentation to the extent that such documents are Included in the fields searched 



Electronic data base consulted during the international search (name ot data base and. where practical, search terms used) 



C. DOCUMENTS CONSIDERED TO BE RELEVANT 



Category " Citation of document, with Indication, where appropriate, of the relevant passages 



Relevant to claim No. 



wo 97 00471 A (CHECK POINT SOFTWARE 
TECHNOLOG ;SHWED GIL (IL); KRAMER SHLOMO 
(ID) 3 January 1997 
see page 5, line 5 - page 7, line 18 
see page 19, line 20 - page 20, line 2 

US 4 897 874 A (LIDINSKY WILLIAM P ET AL) 
30 January 1990 
see abstract 

see column 2, line 38 - line 55 

-/-- 



1,8,11, 
14 

2,12,15 
2,15 



Further documents are listed in the continuation of box C. 



Patent family members are Bsted in annex. 



" Special categories o( cited documents : 

"A" document defining the general state of the art which Is not 

considered to be of paiticutar relevance 
"E" earlier document but published on or after the international 

filing date 

'L" document which may throw doibts on priority dalmCs) or 
which is cited to establish the publtcationdate of another 
citation or other special reason (as specified) 

"O" document referring to an oral disclosure, use, exhibition or 
other means 

"P" document published prior to the Inlematlonat filing date but 
later than the priority date claimed 



T' later docur7)ent published after the international filing date 
or priority date and not In conflict with the application but 
cited to understand the principle or theory underlying the 
Inventbn 

'X" document of particular relevance; the claimed invention 
canrwt be considered novel or cannot be considered lo 
involve an Inverrtlve step when the document is taken alone 

y document of particular relevance; the claimed invention 
cannot be considered to involve an inventive step when the 
document Is combined with one or more other such docu- 
ments, such combination being obvious to a person skilled 
In the art 

document member of the same patent family 



Date of the actual completion of the international search 



24 August 1998 



Date of mailing of the International search report 



03/09/1998 



Name and mailing address of the ISA 

European Patent Offfce, P.B. 5618 Patentlaan2 
NL ■ 2280 MV Rljswijk 
Tel. (+31-70) 340-2040, Tx, 31 651 epo nl, 
Fax: (+31-70) 340-3016 



Auttwrtzed officer 



Perez Perez, J 



Form PCT/ISAS10 (second shMt) (July I9ft2) 



page 1 of 2 



INTERNATIONAL SEARCH REPORT 



In Itlonal Application No 

PCT/US 98/12229 



C.{Contlnuatlon) DOCUMENTS CONSIDERED TO BE RELEVANT 



Category * Citation of documdnt. with Indication. whara appropriata, of the relevant paasagoa 



Raldvanl to daim No. 



PFITYMANN A ET AL: "NETWORKS WITHOUT USER 
OBSERVABILITY" 

COMPUTERS & SECURITY INTERNATIONAL JOURNAL 
DEVOTED TO THE STUDY OF TECHNICAL AND 
FINANCIAL ASPECTS OF COMPUTER SECURITY, 
vol. 6, no. 2, April 1987, pages 158-166, 
XP000645219 

see the whole document 

WO 95 01023 A (ASCOM TIMEPLEX TRADING AG) 
5 January 1995 

see column 3, line 27 - column 6, line 33 

G. CARONNI ET AL.: "Proposed security 
mechanisms In the "new" Internet" 
SWITCH JOURNAL, 

no. 1, 1996, pages 19-23, XP002075076 
ch 

see the whole document 



12 



7,10,16 
1-16 

1-16 



Fotm PCT/ISA/210 (corainu&tlon of second shaol) (Juty 1992) 



page 2 of 2 



INTERNATIONAL SEARCH REPORT 

Information on patent family members 



ii ttional Application No 

PCT/US 98/12229 



Patent document 


Publication 




Patent family 




Publication 


cited in search report 


date 




memt>er(s) 




datd 


WO 9700471 A 


03-01-1997 


US 


5606668 A 


25-02-1997 




AU 


6135696 


A 


15-01-1997 




CD 

tr 


0807347 A 


1 0—1 1 — 1 QQ7 




JP 


10504168 T 


14-04-1998 




NO 


970611 


A 


15-04-1997 




CA 


2138058 


A 


16-06-1995 




EP 




A 
n 


21-06-1995 




JP 


8044642 


A 


16-02-1996 


US 4897874 A 


30-01-1990 


AU 


606275 


B 


31-01-1991 




AU 


3233889 


A 


23-11-1989 




CA 


1295391 


A 


04-02-1992 




DE 


58923893 


D 


28-09-1995 




ut 


68923893 


T 






EP 


0335555 


A 


04-10-1989 




ES 


2077578 


T 


01-12-1995 




HK 


43396 


A 


22-03-1996 




JP 


2013036 


A 


17-01-1990 




JP 


2594641 


B 


26-03-1997 


WO 9501023 A 


05-01-1995 


AU 


6935994 


A 


17-01-1995 




EP 


0654195 


A 


24-05-1995 




JP 


2735390 


B 


02-04-1998 




JP 


8500478 T 


16-01-1996 




US 


5394402 


A 


28-02-1995 



Form PCT/!SA«10 (patent family anrwx) (JUy 1 992) 



